This is your semi frequent reminder that there is no official AO3 app

All those are unofficial and available on the Google play store as of August 13th 2025. They mirror AO3's content and insert ads, for which the developer gets paid by page impression (that's every time the ad appears in the fic you're reading) not just clicks.

No money goes to AO3, nor to the fic writer. It goes to the person who did the bare minimum.

Many of these apps have poorly worded or non existent privacy policies, so they may also be mining as much data as possible and selling that on to unknown third parties.

Please, just use the official AO3 site and the browser.

PSA

EVERYONE BE CAREFUL. ARCHIVE OF OUR OWN PHISHING SITE (first link)

(the link is purple bc i clicked on it to get the link w/o special characters to report to various phising page report places).

the page leads to what appears to be the normal archive page, w/ the popup about the privacy policy & everything, with the url https://xn--iao3-lw4b.ws/media DO NOT LOG IN. THEY ARE HERE TO STEAL YOUR LOGIN CREDENTIALS. LOOK AT URLS BEFORE ENTERING ANY PERSONAL INFO.

STAY SAFE ON THE INTERNET GUYS!!

please reblog to spread this warning!!

just a heads up to my fellow writers out there that AO3 is currently fighting off bots commenting on people’s works to tell them that AO3 will delete their fics “due to the works being deprecated”, and the deletion will affect their accounts unless the authors delete the fics themselves first. IT IS A SCAM. AO3 will NOT delete your works. please do NOT fall for these bots!

I’ve been told the reason why these bots are doing this is due to copyright infringement issue where they’re trying to steal your works (possibly to train AI but this is just a guess) ‼️‼️‼️and once you deleted your fics, it will be either very difficult or impossible for you to claim ownership of your own fics when they were already deleted.‼️‼️‼️

a reminder that AO3 will never contact you through your comments section (in case they claim to be one of the moderators). AO3 will only contact you through your email address which you use to register your account, and it will be from AO3’s official handle. not some sketchy ass @

so if you get a comment telling you you should “delete your works to protect your account because AO3 is doing blah blah blah” report that comment. don’t delete your works.

PLEASE DO NOT FALL FOR THESE SCAM.

AO3 IS NOT DELETING WORKS.

DO NOT DELETE YOUR WORKS JUST BECAUSE SOMEONE CLAIMS THEY KNOW SOMETHING.

SCAM IS CIRCLING ON TUMBLR ‼️

blogs that i follow or interacted with before keep getting hacked, and i'm receiving suspicious messages from people i've talked to before (for a 2nd or 3rd time now). and it usually starts by trying to start a conversation with one random word (sometimes it's "hi" or "yo" or something like that with no follow up), just wanted to tell you that if u see someone u know writing you and it's not in their usual manner, please do not interact! it's a scam and they were probably hacked.

please reblog to spread the word so more people are aware. stay safe everyone, and be sure your account is properly secured!

@elena-gilbert @rosehathawhey @daniellecamp @ceeyoutea @illistandrista @beelsebub @lordjohnwgrey @doctorobinavitch @pwmovs @galindaelphaba @buckley-robins @wandasmaximofffs @linusbenjamin @yenvengerberg

I see a lot of posts about struggling to leave comments on fan fiction so I thought I’d make a template that everyone can use.

Copy paste this:

This fic was adjective (great, amazing, wonderful, perfect, heartwarming, etc.)

It made me feel emotional reaction (happy, sad, heartbroken, overjoyed, etc.)

I liked list of parts you liked (how charatcers interacted, the dialogue in one scene, a description, etc.) because of reason why it was good (realistic, emotional, etc.)

Insert favorite quote from story and why.

Thanks for writing this. You did such a great job. Additional compliment (This fic was exactly what I was looking for, this fic made my day, this fic changed my mind on *pairing*.)

SERIOUS: NEW BOT SCAM ALERT

heya!

this right here?

THIS IS ABSOLUTELY NOT REAL.

the "@staff" is just the bio text.

tumblr staff will not contact you through anything other than email or their official accounts, which will all have this badge:

DO NOT ENGAGE WITH THIS OR SIMILAR ACCOUNTS AND ABSOLUTELY DO NOT CLICK ANY LINKS FROM IT.

report and block. i'd also appreciate it if you shared this post, bc that blog was JUST created and was already tagging a LOT of people, and i know not everyone has the scam-sensing instinct, even if this might seem obvious to some.

@staff @tumblr @support

Hey, so, there's a scam going around. it has this image, and it basically says this:

don't click the link! whatever you do, DO NOT click the link! There is NO Tumblr blog that is for support!

It's a trick to get your account hacked, DO NOT CLICK THE LINK!

if you have downloaded 7zip recently or are about to download, check and make sure youre getting the real one,

PSA new tumblr scam

If you post a piece of art and immediately get a comment like this:

This is fake. It's a scam. Do not click any of the links, even those that look like they go to tumblr. Report the comment immediately and block them.

Cybercriminals are abusing Google’s infrastructure, creating emails that appear to come from Google in order to persuade people into handing over their Google account credentials.

This attack, first flagged by Nick Johnson, the lead developer of the Ethereum Name Service (ENS), a blockchain equivalent of the popular internet naming convention known as the Domain Name System (DNS).

Nick received a very official looking security alert about a subpoena allegedly issued to Google by law enforcement to information contained in Nick’s Google account. A URL in the email pointed Nick to a sites.google.com page that looked like an exact copy of the official Google support portal.

As a computer savvy person, Nick spotted that the official site should have been hosted on accounts.google.com and not sites.google.com. The difference is that anyone with a Google account can create a website on sites.google.com. And that is exactly what the cybercriminals did.

Attackers increasingly use Google Sites to host phishing pages because the domain appears trustworthy to most users and can bypass many security filters. One of those filters is DKIM (DomainKeys Identified Mail), an email authentication protocol that allows the sending server to attach a digital signature to an email.

If the target clicked either “Upload additional documents” or “View case”, they were redirected to an exact copy of the Google sign-in page designed to steal their login credentials.

Your Google credentials are coveted prey, because they give access to core Google services like Gmail, Google Drive, Google Photos, Google Calendar, Google Contacts, Google Maps, Google Play, and YouTube, but also any third-party apps and services you have chosen to log in with your Google account.

The signs to recognize this scam are the pages hosted at sites.google.com which should have been support.google.com and accounts.google.com and the sender address in the email header. Although it was signed by accounts.google.com, it was emailed by another address. If a person had all these accounts compromised in one go, this could easily lead to identity theft.

How to avoid scams like this

• Don’t follow links in unsolicited emails or on unexpected websites.
• Carefully look at the email headers when you receive an unexpected mail.
• Verify the legitimacy of such emails through another, independent method.
• Don’t use your Google account (or Facebook for that matter) to log in at other sites and services. Instead create an account on the service itself.

Technical details

Analyzing the URL used in the attack on Nick, (https://sites.google.com[/]u/17918456/d/1W4M_jFajsC8YKeRJn6tt_b1Ja9Puh6_v/edit) where /u/17918456/ is a user or account identifier and /d/1W4M_jFajsC8YKeRJn6tt_b1Ja9Puh6_v/ identifies the exact page, the /edit part stands out like a sore thumb.

DKIM-signed messages keep the signature during replays as long as the body remains unchanged. So if a malicious actor gets access to a previously legitimate DKIM-signed email, they can resend that exact message at any time, and it will still pass authentication.

So, what the cybercriminals did was:

Set up a Gmail account starting with me@ so the visible email would look as if it was addressed to “me.”
Register an OAuth app and set the app name to match the phishing link
Grant the OAuth app access to their Google account which triggers a legitimate security warning from no-reply@accounts.google.com
This alert has a valid DKIM signature, with the content of the phishing email embedded in the body as the app name.
Forward the message untouched which keeps the DKIM signature valid.

Creating the application containing the entire text of the phishing message for its name, and preparing the landing page and fake login site may seem a lot of work. But once the criminals have completed the initial work, the procedure is easy enough to repeat once a page gets reported, which is not easy on sites.google.com.

Nick submitted a bug report to Google about this. Google originally closed the report as ‘Working as Intended,’ but later Google got back to him and said it had reconsidered the matter and it will fix the OAuth bug.